> The full list of articles is in [llms.txt](https://docs.f3cloud.com/llms.txt). Every page has a Markdown version: add .md to its address. This page as Markdown: [https://docs.f3cloud.com/en/client-area/protect-vps-from-unauthorised-access/change-ssh-port.md](https://docs.f3cloud.com/en/client-area/protect-vps-from-unauthorised-access/change-ssh-port.md).

# How to change the SSH port in Ubuntu, Debian and AlmaLinux

How to change the default SSH port 22 to another one without losing access to the server. Opening the port in the firewall, SELinux, Ubuntu 24.04 specifics and checking the connection.

By default, SSH runs on port **22**, and this is the very port that bots looking for servers to hack check first. If you move SSH to another port, most of this “noise” simply disappears from the logs.

It is important to understand that changing the port is an extra measure, not a replacement for proper protection. The main thing is [SSH key login](https://docs.f3cloud.com/en/client-area/protect-vps-from-unauthorised-access/ssh-keys.md), and changing the port complements it well.

> **Do not close your current connection.**
>
> Do all the steps without closing the session you are connected through. You can close it only after login on the new port works in a separate window.

***

### 1. Choose a new port

Any free number from **1024** to **65535** will do. In the examples below we use `2222`, but it is better to pick something less obvious, for example `48222`. Write down the port you chose, because you will need it for every connection.

***

### 2. Open the new port in the firewall

The commands are run on the server.\
On Ubuntu and Debian you can skip this step if your firewall is not turned on.\
On AlmaLinux, CentOS and Oracle Linux you need to do it in any case because of SELinux.

#### Ubuntu and Debian (UFW)

```bash
# Allow connections to the new SSH port
sudo ufw allow 2222/tcp
```
#### AlmaLinux, CentOS, Oracle Linux

```bash
# Open the new port in the firewalld firewall
sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --reload

# By default, SELinux allows SSH only on port 22.
# Install the semanage utility and add the new port to the list
# of ports allowed for SSH
sudo dnf install -y policycoreutils-python-utils
sudo semanage port -a -t ssh_port_t -p tcp 2222
```

***

### 3. Set the new port in the SSH settings

The commands are run on the server.

```bash
# Open the file with our SSH settings. If you followed the guide
# on SSH keys, it already exists. If not, the file will be created
sudo nano /etc/ssh/sshd_config.d/00-security.conf
```

Add a line with the new port to the file.

```ssh-config
# SSH now listens on port 2222 instead of 22
Port 2222
```

To save the file, press <kbd>Ctrl</kbd> + <kbd>O</kbd> and <kbd>Enter</kbd>, and to exit the editor, press <kbd>Ctrl</kbd> + <kbd>X</kbd>.

```bash
# Check the settings for errors. If the command prints nothing,
# everything is fine
sudo sshd -t
```

***

### 4. Restart SSH

#### Ubuntu 24.04 and newer

```bash
# In newer Ubuntu releases SSH is started through a systemd socket,
# so first reload the settings and then restart both the socket
# and SSH itself
sudo systemctl daemon-reload
sudo systemctl restart ssh.socket
sudo systemctl restart ssh
```
#### Ubuntu 22.04 and Debian

```bash
# Restart SSH so it starts listening on the new port
sudo systemctl restart ssh
```
#### AlmaLinux, CentOS, Oracle Linux

```bash
# Restart SSH so it starts listening on the new port
sudo systemctl restart sshd
```

Now we will make sure SSH is really listening on the new port.

```bash
# Port 2222 should appear in the list
sudo ss -tlnp | grep ssh
```

***

### 5. Connect on the new port

Run this command on your own computer, in a **new** terminal window.

```bash
# The -p flag sets the port to connect to
ssh -p 2222 admin@SERVER_IP
```

In Termius, the port is changed in the connection settings, in the **Port** field.

***

### 6. Close the old port 22

Once login on the new port works, close port 22 in the firewall.

#### Ubuntu and Debian (UFW)

```bash
# Delete the rule for the old SSH port
sudo ufw delete allow 22/tcp

# Check the list of rules
sudo ufw status
```
#### AlmaLinux, CentOS, Oracle Linux

```bash
# Remove the standard SSH service (port 22) from the open ones
sudo firewall-cmd --permanent --remove-service=ssh
sudo firewall-cmd --reload

# Check what is open
sudo firewall-cmd --list-all
```

> **If you use fail2ban.**
>
> If you use fail2ban, set the new port in its settings too, otherwise it will block offenders on the wrong port. We showed how to do this in the article [on fail2ban](https://docs.f3cloud.com/en/client-area/protect-vps-from-unauthorised-access/fail2ban.md).

> **If you lose access after all.**
>
> If you lose access after all, open the server with the <kbd>Console</kbd> button in the server list in your client area. From there you can delete the `Port` line from the `/etc/ssh/sshd_config.d/00-security.conf` file and restart SSH.

***

### Our resources

**Telegram channel:** [https://t.me/f3cloud_news](https://t.me/f3cloud_news)\
**F3 Cloud:** [https://f3cloud.com](https://f3cloud.com/en)